How can you list all indexes and the time of their first indexed event?

[endos]

How can you list all indexes and the time of their first indexed event? metadata seems to only show you the hosts, sources or sourcetypes. I can list all indexes with | eventcount summarize=false index=* | dedup index | fields index . Also tried something like this but with no success:

| eventcount summarize=false index=* index=_* | dedup index | fields index 
| map maxsearches=100 search="|metadata type=sourcetypes index=\"$index$\" | eval index=\"$index$\" | stats min(firstTime) as firstTime by sourcetype
| convert ctime(firstTime) "
| fields index sourcetype firstTime

Any ideas?

[gjanders]

If you want to know the first time per index and per sourcetype then tstats is a valid solution:

| tstats earliest(_time) AS _time where index=* OR index=_* by index, sourcetype

However going forward you might want to use something like:
Meta Woot! (I believe this records the first seen times as well as the most recently seen once it is scheduled to run)

Or perhaps these apps might have similar info:
Broken Hosts
TrackMe

[kimberlytrayson]

It's still going to take a while (I assume you're only doing this once) but can use tstats:

| tstats earliest(_time) as firstTime by index
| convert ctime(firstTime)

[TISKAR]

Hello,

Can you try this:

index=_*
| stats earliest(_time) as earliest_index by index
| eval earliest_index=strftime(earliest_index,"%Y-%m-%d %H:%M:%S")

🙂

[endos]

Thanks for the answer! 🙂
Yeah this would work fine but we have too much data so the search would take too long. Hence the reason why I tried to solve it with |metadata